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Abstract 

We present an explicit measurement in the Fourier basis that solves an important case of the Hidden 
Subgroup Problem, including the case to which Graph Isomorphism reduces. This entangled measure- 
' ment uses k = log 2 \G\ registers, and each of the 2* subsets of the registers contributes some information. 

While this does not, in general, yield an efficient algorithm, it generalizes the relationship between Subset 
Sum and the HSP in the dihedral group, and sheds some light on how quantum algorithms for Graph 
Isomorphism might work. 
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1 Introduction: The Hidden Subgroup Problem 



CO 
> 

£^ ' Many problems of interest in quantum computing can be expressed as, or reduced to, an instance of the 

Hidden Subgroup Problem (HSP). We are given a group G and a function / with the promise that, for some 
subgroup H C G, f is invariant precisely under translation by H: that is, f{gi) — /(<?2) if any only if 
9i — 92^ for some h 6 H. We then wish to determine the subgroup H. Every known efficient algorithm 
' for this problem — and, indeed, almost every quantum algorithm that provides an exponential speedup over 

the best known classical algorithm — uses the approach of Fourier sampling [5]- By preparing a uniform 

~~ — superposition over the elements of G, querying the function /, and then measuring the value of /, we obtain 

a uniform superposition over one of the (left) cosets of H, 

S : \<&) = -}=m E \ ch ) 

where c is a uniformly random element of G. Alternately, we can view this as a mixed state over the left 
cosets, the coset state, with density matrix 
• i— i . 

P =-L\2\cH)(cH\ . 

I G I ceo 

We then carry out the quantum Fourier transform on \cH), or equivalently p, and measure the result. 

For example, in Simon's problem |34| . G = Zj and there is some y such that f(x) = f(x + y) for all x; in 
this case H — {0, y} and we wish to identify y. In Shor's factoring algorithm 33 G is the group Z* where n 
is the number we wish to factor, f(x) — r x mod n for a random r < n, and H is the subgroup of Z* whose 
index is the multiplicative order of r. (However, since |Z* | is unknown, we actually perform the Fourier 
transform over Z 9 for some q = 0(n 2 ); see or ^3E].) I n both these algorithms, G is abelian, and it 
is not hard to see that for any abelian group a polynomial number 1 of experiments of this type allow us to 
determine H . In essence, each experiment yields a random element of the dual space H 1 - perpendicular to 
-ff 's characteristic function, and as soon as these elements span H 1 - we can determine a set of generators for 
H by linear algebra. 

While the nonabelian hidden subgroup problem appears to be much more difficult, solving it would 
provide enormous benefits. In particular, solving the HSP for the symmetric group S n would provide an 

1 Throughout the paper, the terms polynomial, subcxponential, etc. refer to a function of log \G\. 
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efficient quantum algorithm for the Graph Automorphism and Graph Isomorphism problems (see e.g. |21) 
for a review). Let Gi,G2 be two rigid, connected graphs of size n, and let H C £271 be the automorphism 
group of their disjoint union. If G\ = G2, then H = {1, m} is of order 2, consisting of the identity and an 
involution m composed of n disjoint transpositions; if G\ =^ G2, then H is the trivial subgroup consisting 
only of the identity. Thus even distinguishing subgroups of order 2 from the trivial subgroup would be 
sufficient to solve this case of Graph Isomorphism. Other important motivations include the relationship 
between the HSP on the dihedral group and hidden shift problems [H] and cryptographically important cases 
of the Shortest Lattice Vector problem |30| . 

So far, explicit polynomial-time quantum algorithms for the HSP are known only for a few families of 
nonabelian groups [3J EH Ell HOI EEl EH However, the basic idea of Fourier sampling can certainly be 

extended to the nonabelian case. Fourier basis functions are homomorphisms : G — > C such as the familiar 
4>k(x) = e 27rlkx / n when G is the cyclic group Z„. In the nonabelian case, one instead considers representations 
of G, namely homomorphisms a : G — > U(V) where U(V) is the group of unitary matrices acting on some 
vector space V of dimension d a . The irreducible representations are those which are not isomorphic to direct 
sums of representations on lower-dimensional subspaces, and we denote the set of irreducibles by G. We 
refer the reader to for an introduction. We denote the set of functions : G — > C with ||?/>|| 2 = 1, 
i.e., the Hilbert space of a group- valued register, as C[G]; then the quantum Fourier transform consists of 
transforming vectors in C[G] from the basis {\g} \ g £ G} to the basis \o~,i,j) where a is the isomorphism 
type, or "name," of an irreducible representation and 1 < i, j < d a index a row and column (in a chosen 
basis for V). This transformation can be carried out efficiently for a wide variety of groups pfl 1171 177] , 

Several varieties of measurement in the Fourier basis have been proposed. Weak Fourier sampling consists 
of measuring just the name a of the irreducible representation. Strong Fourier sampling consists of measuring 
the name a and the column j in a basis of our choice. (As the state p is mixed uniformly over the left cosets, 
it is easy to show that measuring the row provides no information) . As an intermediate notion, one can also 
consider measuring the column in a random basis for V. 

Unfortunately, a series of negative results have shown that these types of measurement will not succeed 
in solving the Hidden Subgroup Problem in the cases we care most about — in particular, the case relevant 
to Graph Isomorphism In particular, Moore, Russell and Schulman |2S] showed that strong 

Fourier sampling fails, in the sense that we need an exponential number of experiments on single coset states 
to distinguish the order-2 subgroups from the trivial subgroup. 

However, there is still reason for hope. In the above description of Fourier sampling, / is queried just once, 
giving a coset state on a single group-valued register. One can also consider multiregister experiments, in 
which we carry out k queries of /, prepare k independent coset states, and then perform a joint measurement 
on the product state p = p® k — p • • • ® P- Note that this measurement does not generally consist of k 
independent measurements; rather, it is an entangled measurement, in which we measure vectors in C[G fc ] 
along a basis whose basis vectors are not tensor products of k basis vectors in C[G}. For instance, Ip [0?] 
showed that the optimal measurement in the dihedral group is already entangled in the two-register case. 

In one sense we already know that such a measurement can succeed. Ettinger, H0yer and Knill 8 4 showed 
that the density matrices p become nearly orthogonal for distinct subgroups for some k = 0(log |G|). As a 
consequence, a measurement exists which determines the hidden subgroup with high probability. In [5j they 
make this result somewhat more constructive by giving an algorithm which solves the HSP by performing a 
brute-force search through the subgroup lattice of G; however, for groups of interest such as the symmetric 
groups, this algorithm takes exponential time. For the dihedral groups in particular, Kuperberg [23] devised 
a subexponential algorithm, which uses 2°( v/logn ) time and registers, that works by combining two registers 
at a time and decomposing them into irreducibles. 

Regev |2D] provided a beautiful kind of worst-case to average-case quantum reduction, by showing that 
the HSP for the dihedral group D n can be reduced to uniformly random instances of the Subset Sum problem 
on Z n . Bacon, Childs, and van Dam deepened this connection by determining the optimal multiregister 
measurement for the dihedral group, and showing that it consists of the so-called pretty good measurement 
(PGM); they used this to show a sharp threshold at k = log 2 n for the number of registers needed to solve 
the HSP. Moore and Russell |2U generalized their results to some extent, showing that the PGM is optimal 
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for arbitrary groups G in the single-register case whenever we wish to distinguish the conjugates of some 
subgroup H from each other, and optimal in the multiregister case whenever (G, H) form a Gel'fand pair. 

Whether a similar approach can be taken to the symmetric group S n is a major open question. In par- 
ticular, we would like to know whether there is a worst-case to average-case reduction analogous to Regev's, 
connecting the HSP to some Subset Sum-like problem and whether this would result in new subexponential- 
time quantum algorithms for Graph Isomorphism. Some recent results show that indeed any such measure- 
ment requires a high degree of entanglement: Moore and Russell showed that performing strong Fourier 
sampling on two registers in S n requires a superpolynomial number of experiments (specifically, e^^™ 1 ' lo s™)) 
to distinguish order-2 subgroups {1, m} from the identity, or from each other, and conjectured that Q(nlogn) 
registers are necessary. Hallgren, Moore, Rotteler, Russell and Sen ^H] proved this conjecture, showing that 
O(nlogn) registers are necessary and sufficient. Interestingly, the variance over m in the observed probabil- 
ity distribution in the multiregister case has a term for each subset of the registers |25j . pointing towards an 
algorithm that finds a subset with particularly high variance, and thus gives a large amount of information 
about the hidden subgroup. 

Our contribution. In this paper, we consider the special case of the HSP relevant to Graph Isomorphism: 
namely, where we wish to distinguish the conjugates of some subgroup H from the trivial subgroup, where 
H has a "missing harmonic" (defined below). We give an explicit fc-register measurement in the Fourier 
basis that distinguishes these two cases. Our approach relies on decomposing the tensor product of the 
representations observed in a given subset of the registers into a direct sum of irreducibles. Each subset of 
the registers contributes a small amount of information, so that when k > log 2 |G| the measurement succeeds 
with constant probability. We hope that this may lead to worst-case to average-case quantum reductions 
involving generalizations of the Subset Sum problem. 

2 Missing Harmonics 

We start by preparing independent coset states in k independent G- valued registers, giving the tensor product 

\ 1 1 ceo J 1 1 c eG k 

Note that p can also be thought of as a random left coset of the product subgroup H k 6 G k . Note also that 
p is the completely mixed state over C[G]® fc = C[G fc ] if H is the trivial subgroup {1}. 

Here we give an explicit measurement in the Fourier basis which solves an important special case of the 
HSP, including the case relevant to Graph Isomorphism: namely, given a (non-normal) subgroup H C G, we 
wish to distinguish the conjugates of H from the trivial subgroup. Our measurement succeeds with constant 
probability whenever k > log 2 |G|. 

Recall that for any representation t, the average of r over a subgroup H is a projection operator, which 
we denote t(H) = (1/\H\) J2heH T Q 1 )- Note that t(H) is generally not of full rank, and indeed t(H) = t dr 
if and only if H is contained in the kernel of r. Let us say that an irreducible representation r\ is a missing 
harmonic of H if rj(H) = 0; this is then true for all of H's conjugates as well. For instance, if G is the 
dihedral group D n and H = {l,m} where m is one of the n "flips," then the sign representation tt is a 
missing harmonic. Similarly, if G is the symmetric group S2n where n is odd and H is the order-2 subgroup 
corresponding to an isomorphic pair of rigid graphs, then the sign representation 7r, which takes even and 
odd permutations to +1 and —1 respectively, is a missing harmonic. 

For simplicity, we focus on the case where H has some missing harmonic 77; the idea is that if we ever 
observe it, then we know that the hidden subgroup must be trivial rather than a conjugate of H. The 
following lemma gives some sufficient conditions for H to have a missing harmonic; these are intended as 
examples, and are by no means exhaustive. 
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Lemma 1. If any of the following conditions hold, then H has a missing harmonic: 

1. H is normal and nontrivial. 

2. H intersects every coset of some proper normal subgroup K <\G. 

3. G — S n and H is transitive. 

I \G\/\H\<C where C = J2red d r ■ 

Proof. 1) Recall that if H is normal then for every t 6 G, cither t(H) = td T or t{H) =0. If H is not the 
trivial subgroup, then the latter must be true for at least one r. 

2) Recall that any irreducible representation of G/K gives an irreducible representation r of G by 
composing it with the homomorphism </> : G — > G/K. Since <fi(H) = G/K, we have t(H) = for any such r 
other than the trivial representation. (For instance, in Graph Isomorphism where n is odd, H is transverse 
to the alternating group A n and r is the sign representation.) 

3) Let r be the standard representation, corresponding to the Young diagram (n — 1, 1). This permutes 
the n vertices of an (n — l)-dimensional simplex centered at the origin. If H is transitive, then for any i, j 
exactly 1/n of the elements of H take vertex i to vertex j, and so the average t(H) = is zero. 

4) Recall that the regular representation Reg, namely C[G] under left multiplication by G, consists of d T 
copies of each t G G. It is a simple exercise to show that rk Reg(-ff) is the index |G|/|£T|, and since 



3 Decomposing Subsets of the Registers 

The state p is a density matrix defined on the Hilbert space CfG*] = C[G]® fe . Since it is completely mixed over 
left cosets of H k , it commutes with left multiplication in G k . It follows from Schur's lemma |23U25ll2l)] that p 
is block-diagonal in the Fourier basis, where each block corresponds to one of the irreducible representations 
of G k . These are tensor products of irreducible representations of G, cr = a\ ® ■ ■ ■ ® . To put it differently, 
the optimal measurement is consistent with first performing weak Fourier sampling on each of the k registers, 
observing the representation names o~\ , . . . , <7fc. 

The question is how to refine this measurement further, decomposing cr into smaller subspaces. (We abuse 
notation by identifying subspaces with the name of the representation that acts on them.) Happily, there is a 
natural way to do this that respects the structure of G: specifically, we treat cr as a representation of G (rather 
than of G k ) by restricting to the diagonal action, where the element g 6 G acts by er(g) = <Ji{g) ® ■ • -®crk{g). 
We can then further decompose cr into irreducible representations r € G under this action. If we observe a 
missing harmonic r\ under this decomposition, we know that the hidden subgroup is trivial rather than being 
a conjugate of H. Unfortunately, in all cases of interest r\ is very low-dimensional (indeed, one-dimensional), 
and so the chances of observing r\ are exponentially small even if the hidden subgroup is trivial. Thus this 
direct approach does not work. 

Instead, we focus on some subset / C [fc] of the registers. First, we can decompose cr into the tensor 
product of the registers inside and outside I, cr = ((£) ieI 17 i) ■ Now consider the decomposition of 

the registers in I into irreducible representations of G under the diagonal action, in which we right-multiply 2 
every register in / by g and leave the other registers fixed. We write (£) ieI o~i = t\ © • ■ ■ © Tt. Fixing our 
missing harmonic r\, for each nonempty I this gives us a subspace 



rk Reg(F) = ^ rf T rk t(H) 



red 



we have rk Kcg(H) > C, a contradiction, if t(H) ^ for all r € G. 



□ 




2 We use right multiplication because left cosets of H are invariant under right multiplication by H. 
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and we define Hi „ as the projection operator which projects onto this subspace. That is, 11^ a projects the 
registers in / into irreducible subspaces isomorphic to 77, and leaves the other registers fixed. The following 
lemma shows that if 77 is a missing harmonic for iJ, then each of these projection operators annihilates p. 

Lemma 2. Suppose that r](H) = 0. Then for all nonempty I C [k] and all <r . 11^ CT p = 0. 

Proof. The state p is symmetric under right multiplication by any h G H k . In particular, it is symmetric 
under right diagonal multiplication by any h 6 H on the registers in /. Let PJ H be the operator which 
symmetrizes over this action: that is, the average over all h G H of the unitary operator that right-multiplies 
by h where hi = h for i E I and hi = 1 for i £ I. Then 



n 

and so 



p = R I H p(R I H y and U^R^ = 

n I VtCr p=(n I nter R I H )p(R I H y = . 



□ 

Now we patch these operators together to form our measurement. Let 

W v , a = span^fcjW^ 

be the span of all these subspaces, and let n^ i(T be the projection operator onto W^^. By Lemma|21 we know 
that Tlrj.o- p = whenever 77 is a missing harmonic for the hidden subgroup. Thus we can distinguish the 
conjugates of H from the trivial subgroup with a measurement operator that reports "trivial" if it observes 
the subspace W VirT , and "don't know" if it observes the perpendicular subspace W^ a . Since p is completely 
mixed if the hidden subgroup is trivial, the probability that our operator reports "trivial" in that case is 
dim W 7hrT /dcr. We wish to show that if k > log 2 \G\, the expectation over a of this fraction is at least 1/2, 
so that our measurement distinguishes the trivial subgroup from conjugates of H with constant probability. 

To calculate this expectation, it is convenient to work in the entire Hilbert space C[G fc ] of the k registers, 
rather than conditioning on having observed the representation names er. Recall that the action of G on 
C[G] under (right) group multiplication yields the regular representation Reg, and that Reg contains d CT 
copies of each a E G. It follows that the fraction of C[G], dimensionwise, consisting of copies of a is d^/\G\. 
This fraction is also the probability that we observe the representation name a in a given register when 
we perform weak Fourier sampling on the completely mixed state, and is called the Plancherel distribution 
Planch(er). Similarly, C[G fe ] can be thought of as the regular representation of G k , in which case it contains 
dcr = Y\i d ai copies of each er, giving the Plancherel distribution Planch(er) = Planch(<7i). Thus we have 

Exp. dlm >- =^Planch( C r) dim 7"- CT = dim ^ 



\G\ k |G|* 



In other words, the expected dimensionwise fraction of W^. CT in er is the total dimensionwise fraction of W n 
in all of C[G k ], where 

W v = span.IV^o- . 

We can also write 

Wr, = span / c[ fe ]W / ^ 

where 

W* = span^W^ 

is the subspace of C[G fc ] spanned by vectors for which, if we decompose the registers in / into G-irreducibles, 
we observe the representation name 77, regardless of what G fc -representation er they lie in. 
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We wish to lower bound the fraction of C[G fc ] consisting of W v . First, we ask how much of C[G fc ] consists 
of each W^. Recall that for any representation (f>, cf> ® Reg consists of the direct sum of copies of Reg. In 
particular, Reg® contains \G\ e ~ 1 d a copies of each a G G. Thus for any /, if |/| = I we have 

W* = |Gf _1 d,»7 ® Reg®( fe "^ 

and so 

\G\ k \G\ k \G\ ' U 

In other words, each W* occupies the same fraction of C[G k ] as r\ occupies of C[G), namely the Plancherel 
distribution. This is just 1/\G\ in the cases we care about, but then again there are 2 k subsets /. Our hope 
is that when k ~ log 2 |G|, then, the span of all the WJ. occupies a large fraction of the Hilbert space. 

Indeed, if the subspaces W* for different I were orthogonal, their dimensions would simply add, giving 
dimW,, = (2 k — l)dimW 7 ; however, it is easy to see (even for G = Z 2 and k = 2) that this is not the 
case. Instead, it turns out that the subspaces W* have a remarkable statistical property akin to pairwise 
independence, which we describe in the next section. 



4 Independent Subspaces 

We say that two subspaces W\, Wi are independent if the expected squared projection of a random vector 
v e W\ into Wi is just what it would be if v were a random vector in the entire space, i.e., the dimensionwisc 
fraction of that space occupied by Wi- This is a kind of statistical independence between the events that 
we observe Wi and Wi (although if their projection operators do not commute, we cannot consider these 
simultaneously as quantum observables!) Formally: 

Definition 1. Let V be a vector space. Let W\,Wi be subspaces with projection operators IIi , II2 . Let w be 
chosen uniformly at random from the vectors in W\ with norm 1 . Then W\ and W2 are independent if 

2 dimW 2 
Exp. |IFH = — - . 

Equivalently, if v is chosen uniformly at random from the vectors in V with norm 1, 

2 dimIFidimVF 2 

ExpjirrM =^- v ^- v . 

A family of subspaces W\, . . . , W m is independent if Wi and Wj are independent for any distinct i, j. 



Note that this definition remains the same if we choose iootd uniformly from an orthonormal basis for Wj 



or V respectively, rather than from the sphere of radius 1. Indeed, since Exp„ |nin 2 u| = trllilVdimV, 
a more compact definition is the following: 

, tr±Iitrn 2 dimIFidimVF 2 

trIIin2 = dimy = • (3) 

Note, however, that ilin 2 is not a projection operator unless IT and n 2 commute. 

Lemma 3. Let L,JC [k] be distinct and nonempty. Then W* and are independent. 

Proof. We use the fact that for any representation U and an irreducible representation t, the projection 
operator onto the isotypic subspace corresponding to r — that is, the span of all the copies of r in U — is 

|G| 9 ec 



1 
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In particular, if LT^ projects onto W^, we have 



and 

, 2 



n X = ( W\ ) E XvW Xv(9'T RfigCff) 8 ^- ® Reg( ff5 ')^ (/nJ) ® Reg(s')® ® l^ fc ^ /UJ » 
g,g'eG 



\G\ 

where the notation A® 1 denotes the tensor product (g>j 6 jA Taking traces, since XReg(<?) = |G| for g = 1 and 
for j^l, whenever I =/= J the summand is zero unless both g = 1 and <?' = 1. In this case the summand 
isc^|G| fc , so 

trnX=f^|J \G\ k ■ 

Since trll^ = trlTf = (d 2 /\G\)\G\ k by ©, we see that 11^ and 11^ satisfy © and are independent. □ 

Finally, we lower bound the dimension of the span of a independent family of subspaces with the following 
lemma, and show dimW,j/|G| fc > 1/2 whenever k > log 2 \G\. 

Lemma 4. Let V have dimension D, and let Wi, . . . , W m C V be a independent family of subspaces of 
dimension d, and let W = span^Wi. Then 

dimly 1 
> 1 



D ~ l + md/(D -d) 

Proof. Let IL project onto Wi for each 1 < i < m, and consider the operator M — Y^iLi Dm- Since M is 
positive and symmetric, it can be diagonalized, and has nonzero eigenvalues Ai, . . . , At > where its rank is 
t = dim W. Its trace is 



V] Xe = md . (4) 



Then using J2J, the Frobenius norm of M is 



* d 2 
|Af|| 2 = ^ A ^ =trM f M = 2^trII i n j - = md + 2_, tr n i n j = m<f + m(m - 1)— . (5) 



£=1 ij i^j 

On the other hand, by Cauchy-Schwartz we have 

/ t \ 2 t 



J> < t^> 2 (6) 



Combining Q, © and JBJ gives 



/ j 1 + (m - 1)-^ 



and so 

t md 1 

> 



D ~ D + (m — l)d l + md/(D-d) 



□ 



Applying this to the independent family {W^ | / C [k],I ^ 0} gives the following corollary. 
Corollary 1. For any k > log 2 \G\, we have diraW rj /\G\ k > |. 

Proof. We have V = C[G fc ], D = \G\ k , m = 2 k - 1 > \G\ - 1, and d/L> = £^/|G| > 1/|G|. Thus 
md/(D — d) > 1, and Lemma 01 completes the proof. □ 
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5 The Representation Kickback Trick 



In this section we show how to efficiently carry out the von Neumann measurement associated with the 
subspace Wl for a fixed subset / of the registers. Of course, this does not tell us how to efficiently carry out 
the measurement associated with their span . 

It suffices to consider the space V = (£) ieI uu decompose V = © T(E g « t t into irreducible representations 
of G, and implement the measurement associated with the projection operator 11^ that projects onto the 
space spanned by the a n copies of 77 in this direct sum above. Our approach is essentially the same as the 
"summand extraction" of Kuperberg . 

To carry out this measurement, we introduce a new G- valued control register, in which we initially 
prepare \G), the uniform superposition over G. Treating our state now as an element of C[G] (£> V, we 
apply the controlled G-action operator: A4 : \g) <E) \<fr) >— > \g) <£) cri(g^ 1 ) \<fi), where cri(g~ 1 ) is the unitary 
operator (^> ie / o~i(g Finally, we compute the quantum Fourier transform on the control register and 
carry out the measurement (on the control register only) corresponding to the operators n,, and 1 — 11^, 
where IT,, : C[G] — > C[G] is the operator that projects onto the irreducible subspaces isomorphic to i]. 

To see why this works, we return our attention to C[G] <E> V. Consider the following two G-actions on 
this space: let Dh : \g) <8> \<j>) 1— > \hg) ® 07 (/i) \(f>) apply the group action to both the control register and V, 
and let Lh : \g) ® \<j>) 1— > \hg) (8 \4>) apply the group action only on the control register. Then observe that 
M. o Dh = LhoA4: evidently, any subspace of C[G] <E> V that is invariant under Dh is (unitarily) transformed 
by M. to a subspace that is invariant under Lh- Observe now that if W C V is an invariant subspace of 
V (under <ri(h)) that is isomorphic to 77, then \G) (g> W is isomorphic to 77 under the action Dh, as \G) is 
invariant under right multiplication by G. Thus such a space is carried to a L/j-invariant space by M, still 
isomorphic to r\. 

6 Discussion 

We have suggested here a general framework for solving cases of the Hidden Subgroup Problem similar to 
that relevant to Graph Isomorphism. Each subset of the registers contributes a small amount of information, 
and the span of all their associated subspaces distinguishes the trivial subgroup from the conjugates of a 
non-trivial subgroup with a missing harmonic. Of course, even though we can project into each of these 
subspaces efficiently, it is far from clear how to product into their span. However, we might hope, through 
some partial measurement, to find an informative subset: that is, a subset / for which a large fraction of the 
state lies in W,| if the hidden subgroup is trivial. 

One approach to finding such a subset is a "sieve," in which we combine states in pairs, project their 
tensor products into irreducible representations, and try to work our way down towards a missing harmonic. 
This builds a tree of tensor products with a missing harmonic at its root, and the chosen subset of registers 
corresponds to the leaves of the tree. This idea is not original with us: if we consider the special case of 
the HSP in the dihedral group D n where we wish to distinguish the trivial subgroup from the n conjugate 
subgroups H = {l,m} where m is a "flip," this is exactly what Kuperberg's algorithm does. Namely, it 
combines two-dimensional representations, decomposing them according to <Xj ® <Xj = Oj+j © Vi-j, until we 
reach ctq = 1 © it. We then perform a measurement inside erg, and if we ever observe the sign representation 
7r we know that the hidden subgroup is trivial. 

Using a somewhat different type of sieve, Alagic, Moore and Russell pQ recently obtained a subexponential- 
time algorithm for the HSP in groups of the form G n for finite G. Even though these groups have a simple 
structure, they are similar to S n in that most of their irreducible representations are exponentially high- 
dimensional, and it was shown in JH] that solving their HSP requires entangled measurements over f2(n) 
registers. Whether a similar sieve can work for S n , providing an efficient (even subexponential) quantum 
algorithm for Graph Isomorphism remains an open question. 
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